Let me say something that might be uncomfortable if you’ve spent your career building security infrastructure.
The firewall isn’t your biggest risk. Neither is the unpatched server, the misconfigured VPN, or the overly permissive security policy. Those things matter — I spend most of my working life dealing with them — but they’re not where most breaches actually start.
Most breaches start with a person.
An email that looks real. A phone call from someone claiming to be from IT. A link clicked at 11pm on a Friday when someone’s tired and not paying attention. A contractor whose access was never revoked after they left six months ago.
I’ve seen all of these. The human element is the one variable that no amount of technical controls fully addresses.
Why Technical Controls Have a Ceiling
When you build a network security architecture, you’re making assumptions. You’re assuming that the traffic flowing through your firewall is being generated by legitimate users doing legitimate things. You’re assuming that the credentials authenticating to your systems belong to the people they were issued to. You’re assuming that the behaviour you’re seeing is intentional.
Social engineering attacks break every one of those assumptions.
Your firewall can’t stop an employee who hands over their password willingly — because from the firewall’s perspective, that’s a valid login from an authorised user. Your IDS can’t flag normal-looking activity — because the attacker, now operating as a legitimate user, is doing exactly what that user would do. Your SIEM can’t alert on something it can’t distinguish from normal behaviour.
This is what makes the human factor so dangerous. It doesn’t trip your controls. It walks right through them.
The 2023 Verizon Data Breach Investigations Report put the figure at 74% of breaches involving the human element — through error, privilege misuse, social engineering, or stolen credentials. IBM’s Cost of a Data Breach Report puts the average breach cost at $4.45M. Proofpoint’s State of the Phish research consistently shows that 91% of cyberattacks start with a phishing email.
These aren’t edge cases. They’re the dominant attack pattern.
What This Actually Looks Like in Practice
I want to give you a realistic picture of how these attacks unfold, because the training video version — someone clicking an obviously suspicious email with bad spelling and a Nigerian prince — isn’t how it works anymore.
Modern phishing is targeted. The attacker has done their reconnaissance. They know who your CEO is, who your finance team reports to, what projects your organisation is working on. The email looks like it came from your CFO. The request makes sense in context. The urgency is plausible.
And the link goes to a login page that looks exactly like your Microsoft 365 portal. Or your VPN gateway. Or your HR system.
The employee enters their credentials. The attacker captures them. Now they have valid access to your environment — and none of your perimeter controls know anything is wrong.
From there, lateral movement. Privilege escalation. Data exfiltration. Depending on the objective, potentially ransomware deployment.
All of it started with one person clicking one link.
The Specific Gaps I See Most Often
Security awareness training that runs once a year.
An annual checkbox exercise doesn’t change behaviour. People forget. The threat landscape changes. The attack techniques evolve. If your security awareness programme runs once a year and the rest of the year nobody talks about it — you don’t have a security awareness programme. You have an audit artefact.
Effective security awareness is continuous. Short, frequent, relevant. Simulated phishing exercises that give people immediate feedback when they click. Regular communication about current threats. A culture where people actually talk about this stuff.
MFA only on VPN.
This is extremely common and it’s a significant gap. MFA on the VPN is good. But once someone is through the VPN, they often have unfettered access to internal applications with nothing more than a username and password standing between them and your critical systems.
MFA should be on everything. Email. Internal applications. Admin portals. Cloud services. Especially anything that handles sensitive data or has elevated privileges.
Palo Alto’s Authentication Policy lets you require additional authentication for specific internal resources — even for users who are already on the network. It’s one of the most underused features in the platform and one of the highest-value ones from a human-factor perspective.
Offboarding processes that don’t include immediate access revocation.
I’ve seen environments where departed employees still had active accounts weeks after they left. Sometimes months. In one case I came across an account that had been active for over a year after the person left the organisation.
This isn’t malicious on anyone’s part — it’s a process gap. IT doesn’t always get notified promptly when someone leaves. HR and IT aren’t always well-integrated. The account sits there, and the risk sits there with it.
Proper offboarding means access revocation on the last day of employment. Not the week after. Not when someone gets around to it. The same day.
Excessive privileges that were never reviewed.
Least privilege is a well-understood security principle. It’s also one of the most consistently violated ones.
People accumulate privileges over time. They need access to something for a project. The project ends. The access stays. They move to a different team. Their old access stays. They get promoted. Now they have their old access and their new access and nobody’s ever reviewed the combination.
Regular access reviews are boring. They’re also essential. And when you do them properly — actually looking at what each person has access to and whether they still need it — you almost always find things that should have been revoked a long time ago.
What Actually Moves the Needle
None of what follows is revolutionary. But the gap between knowing these things and actually doing them consistently is where most organisations fall short.
Treat security awareness as infrastructure, not an event. Build it into your onboarding. Run regular simulated phishing exercises. Share threat intelligence with your teams in plain language — not security jargon, actual examples of what attacks targeting your industry look like right now.
Make reporting easy and consequence-free. One of the most damaging things an organisation can do is create a culture where people are embarrassed or afraid to report that they clicked something suspicious. If people hide mistakes, you lose your early warning system. When someone reports a suspicious email or admits they clicked a link, that’s a good outcome — because you found out in time to respond.
MFA everywhere, enforced, no exceptions. There’s no legitimate reason for a business application handling sensitive data to be protected only by a password in 2026. If you have legacy systems that genuinely can’t support MFA — that’s a risk that should be formally accepted and tracked, not quietly ignored.
Integrate HR and IT offboarding. Whether that’s through your ITSM system, through directory integration, or through a simple checklist that gets actioned on the last day — departing employee access needs to be revoked immediately. Build the process and audit it regularly.
Run access reviews on a schedule. Quarterly for privileged accounts. Annually for everyone else at minimum. The first time you do this on a mature environment it’ll take a while. After that it gets faster. And the risk reduction is significant.
The Technology Still Matters
I want to be clear that none of this is an argument against investing in security technology. Firewalls, EDR, SIEM, UEBA, Zero Trust architecture — all of it matters and all of it reduces risk.
But technology addresses what you can see and define. It catches the attacks that behave like attacks. It struggles with attacks that look like normal behaviour because a legitimate user account is being used by an illegitimate actor.
The human layer is where that gap lives. And closing it requires investment in people and process, not just tools.
The most sophisticated security stack in the world still has a single point of failure: the person sitting in front of the keyboard.
One Practical Step
If you want to do one thing this week that will meaningfully reduce your human-factor risk — run a phishing simulation.
There are tools that make this straightforward. Send your team a realistic phishing email. See who clicks. See who reports it. See who does nothing.
Don’t use the results to shame anyone. Use them as a baseline. Then run another one in a month. And another one after that. Track whether the click rate goes down over time.
That data tells you more about your actual security posture than most technical assessments.
The stats in this post are sourced from the IBM Cost of a Data Breach Report 2023, Verizon Data Breach Investigations Report 2023, and Proofpoint State of the Phish 2023.
Majid Ahmed — CCIE #55880 | CISSP | PCNSE | Senior Network & Security Engineer Connect on LinkedIn